feat(phase-2): VC-style .pptx deck with anti-hallucination Layer 2 #21

	name: CI

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	permissions:
	contents: read

	concurrency:
	group: ci-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	python:
	name: lint / type / test
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: "3.11"
	cache: pip

	- name: Install dev dependencies
	run: \|
	python -m pip install --upgrade pip
	pip install -e ".[dev]"

	- name: ruff
	run: ruff check .

	- name: mypy (best-effort during phase 0)
	run: \|
	if [ -d src/ycai ] && [ -n "$(find src/ycai -name '*.py' -not -empty)" ]; then
	mypy src/ycai
	else
	echo "no source yet — phase 0"
	fi

	- name: pytest
	run: pytest -q

	secret-scan:
	name: secret scan
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	with:
	fetch-depth: 0

	- name: Set up Python (for detect-secrets)
	uses: actions/setup-python@v5
	with:
	python-version: "3.11"

	- name: Install detect-secrets
	run: pip install detect-secrets

	- name: Custom regex sweep
	run: bash scripts/secret_scan.sh

	- name: gitleaks
	uses: gitleaks/gitleaks-action@v2
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

	publish-check:
	name: publish hygiene
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- name: publish-check
	run: bash scripts/publish_check.sh

Provide feedback